Re: [PATCH tty] tty: n_gsm: fix use-after-free in gsm_queue vs gsm_cleanup_mux race

[Greg KH <gregkh@linuxfoundation.org>]

On Fri, May 29, 2026 at 02:28:22PM +0800, Zhenghang Xiao wrote:
> Resending this email as plain text, since the previous reply was
> rejected by the mailing list for containing an HTML part.
> -------------------
> Thanks for your reply!
> 
> > How to test
> I built two identical arm64 kernels (v7.1.0-rc4), differing only by
> this patch. Both kernel carry a msleep(20) instrumentation in
> gsm_queue() to widen the race window. Then run PoC and the patched
> kernel do not report kASAN again.

What PoC?  Do you have the hardware that uses this ldisc?

> > What prevents dead from changing
> Nothing prevents it and it doesn't need to. tty_ldisc_flush() is the
> sync mechanism not dead check.
> If gsmld_receive_buf() is already past the check, it's running under
> buf->lock. The patch moves tty_ldisc_flush() before DLCI release. And
> tty_buffer_flush() acquires the same buf->lock, so it blocks until the
> in-flight receive completes. DLCIs are freed only after that.
> 
> The dead check handles the other direction, any receive that starts
> after the flush sees dead == true and returns early. But I'm not sure
> if silent drop here is fine or not.

I don't think dropping is ok, test this on real hardware to see what
happens.

Also, this should be 2 patches, not 1, right?

thanks,

greg k-h